Re: [PATCH net] l2tp: only return sessions of the given tunnel in l2tp_session_get()

[Hengyu Liang <hengyul@cs.unc.edu>]

Hi Guillaume,

Thanks, that makes the intended semantics clear.

On Mon, Oct 26, 2026 at 05:55:07PM +0100, Guillaume Nault wrote:
> The correct approach would be to pass both a session ID and a socket
> for any L2TPv3 UDP session lookup. But the netlink interface currently
> doesn't support passing a socket fd for SESSION_GET, SESSION_MODIFY
> and SESSION_DELETE operations.

In the kernel the callers already have both. They look up the tunnel by
ID and pass tunnel->sock to l2tp_session_get(). The case that is missed
is a session ID that has not collided: l2tp_v3_session_get() returns the
IDR entry without checking sk.

> This last operation could maybe be simplified to a simple tunnel ID
> check, as, in my understanding, we have an 1:1 relationship between
> tunnel IDs and their sockets (but I'm a bit wary of such shortcuts
> given that code have proved to be brittle in the past).

In v2 I will compare the session's tunnel socket with sk instead of
comparing tunnel IDs, so the check does not depend on that mapping. It
does hold today: tunnel IDs are unique per netns, and
l2tp_validate_socket() returns -EBUSY for a socket that already has a
tunnel.

I will also reword the commit message to describe session IDs as you
did: unique per netns, and per UDP socket for UDP encap.

Do you have any other comments? If not, I will send v2 with these
changes.

Thanks,
Hengyu